FTC Proposes Order to Stop GM from Sharing Driver Behavior Data

The Federal Trade Commission has proposed a consent order that would restrict General Motors and its OnStar subsidiary from sharing drivers’ geolocation and behavioral data with consumer reporting agencies for a five-year period. The regulatory action addresses allegations that GM and OnStar failed to properly disclose their data collection and sharing practices, particularly regarding the OnStar Smart Driver feature. This marks the latest enforcement action under FTC Chair Lina M. Khan’s increased focus on digital privacy protection.

According to the FTC’s findings, GM and OnStar collected detailed driving data, including precise location information, hard braking incidents, and late-night driving patterns. This information was then provided to consumer reporting agencies, potentially affecting insurance rates. The commission found that some consumers were unknowingly enrolled in the Smart Driver program without providing explicit consent for data sharing, similar to issues raised in recent telematics privacy lawsuits.

FTC Chair Lina M. Khan noted that GM’s data collection occurred “sometimes as often as every three seconds,” highlighting the granular nature of the tracking. The proposed order aims to implement stronger consumer protections and transparency requirements.

Under the proposed consent order, GM and OnStar would be prohibited from sharing geolocation and behavioral data with consumer reporting agencies for five years. The order mandates obtaining affirmative consent before data collection, providing mechanisms for data access and deletion, and allowing consumers to opt out of precise tracking except in specific circumstances.

The regulatory action represents the FTC’s first major intervention regarding connected vehicle data practices. The automotive industry has increasingly integrated sophisticated data collection systems, including biometric monitoring technologies that track driver alertness through facial expressions, heart rate, and eye movements.

These monitoring systems, while marketed primarily as safety features, generate substantial amounts of personal data that could be valuable for insurance assessment or marketing purposes. The FTC’s action establishes precedent for how such data collection systems must be disclosed and managed, particularly as automakers like Continental and Mitsubishi Electric continue developing advanced biometric cockpit systems.

Automakers face technical and operational challenges in implementing the required privacy controls. Systems modifications may be necessary to enable data deletion and opt-out capabilities, while maintaining effective safety monitoring functions. Industry stakeholders may need to establish standardized approaches to data privacy to maintain consumer trust in connected vehicle systems, especially as biometric features become standard in modern vehicles.

Sources: FTC, InsideHook

–

January 20, 2025 – by Cass Kennedy